I have several devices on my network that, when scanned by Open-Audit, they show up as a switch instead of a computer. The only thing these computers have in common is they have a SmartBoard connected to them. Attached is a screen shot of what Open-Audit sees

When I manually scan and show the "debug" it shows the results below. I notice it says WMI is false but I have checked the PC and WMI is enabled.

2 answers

Okay but I have the Windows Firewall disabled on other machines and WMI is true and I get a proper audit. It looks to me like it has something to do with the SmartBoard connected to the computer. That is the common thread for all of the computers that show up as a switch instead of a computer.

On this machine I do have Windows Firewall disabled and the services show WMI is running. Our network uses Symantec as the firewall, is there anything in the Symantec server that needs to be set to allow Open-Audit to get its info?

If Open-AudIT says WMI = false then "something" is stopping it. From what you have described I would bet on Symantec. I have no knowledge of configuring this client side application - sorry. You could try disabling the Symantec firewall completely to run a test Discovery, then re-enabling it again.

Yep - WMI = false is the answer. This means the Open-AudIT server cannot detect the WMI port being open on the target. Open-AudIT is relying on Nmap to tell it what the device is (which is essentially a guess).

This might be due to the target running a firewall or something in between the target and the server blocking that port.